Raid bots and network detected!!

Recently, earlier today around 1 pm GMT+1, a server called Tropical Promotions has fell victim to a raid bot. This raid bot spammed 5 ads in each channel, all messages accompanied with an @everyone ping, so there were 235 pings in total, maybe even more. Due to this overflow, and the moderation of the moderation bots present in the server, there was a crash before the server got fuly deleted.

In the server were around 350 members, 15 staff members and 20 bots. All invites were closed, which made the conclusion even stronger that the server was indeed deleted. There were some comotions going on the first 10 minutes, reporting the incident to other big servers I was in.

Update: The raid was caused by users named @wifflecat18 and @listener.observer. Please be aware of this user on your server!!

Information found whilst investigating

After sending around the warning to look out for who did it, one person was quick to respond with the ID of the bot that caused the crash, together with screenshots of the profile and the ad that was sent. This turned out to be a specific raid bot, specialised in shutting down and deleting servers. This bot was part of the H1DD3N GANG server, a server specialised for these bots and actions. This bot is 2 months of age.

This server has a YouTube channel, explaining how to use these raid bots and how to harm a Discord server the most they can. 

Further investigation by another person cleared out who the owners were of the bot and of the server. The first owner is "ernestaz." with an account age of 4 and a half years, developer badge on profile and tik tok profile on banner. The second owner is "3xtraterrestria" with an account age of 2 months, developer badge on profile and a cat as pfp and banner. 

Upon joining the server, the person investigating it was met with a verification system by restorecord, combined with a DM. This DM was available in 3 languages: Chinese, English and Russian, where you needed to choose the language to continue. When pressig the right language, they were provided a full tutorial on how to use the bot and the link to invite the bot.

In this server was a message, probably in a rule channel. The message was as followed: "The guild is not involved in any activities that violate the Terms of Service. Any claims linking our server to breaches of these terms ae defamatory. We emphasize that we have no affiliation with any product or service that could harm the Discord platform or others. The guild is a community where people can connect, collaborate and spend time together on constructive projects.

"Furthermore, we want to make it clear that we are not responsible any external attacks made by external Discord users. Unfortunately, we have been targeted by malicious individuals seeking to link our server with activities that could lead to its removal. We insist that such accusations are unfounded and part of efforts to defame our community. All projects within this server are strictyl for educational purposes, aimed at helping users understand the risks of leaving their Discord-related assets unprotected or not under proper control."

This can either be a lie, to minimalise the threat to being deleted from Discord and still perform that dangerous actions, or a real message that is really meant. The percentages lean more towards the accusation of a lie since the 2 owners are owners of the raid bot. 

Gathered Bot information

The bot appeared to be a Vietnamese Raid bot specialised in crashing servers to even deleting server AND users. These bots can sent a certain amount of messages, including a ping or special message if needed, causing the moderator bots to be overused, freezing and causing internal problems in the server. How this happens is not sure yet since the server was deleted not to be found again. There have been logs found of what happened but how they we're found is not sure yet. 

This is sadly not the only bit that moves around servers, across users. Another bot has been detected that does the similar scenario, yet only adresses it as spamming instead of crashing. Who this bot is from isn't sure but they are also part of the H1DD3N GANG server.

Avoid these bots in your server

There is little you can do about these bots joining. They have their way of working around verification systems to even creating a role that has administrator permissions. Every bot is indeed different with different purposes but it is always best to directly ban the bot if they entered and the person who invited this bot into the server. 

The best you can do is setting up a strict verification system and have multiple moderator bots like carl-bot and Wick in your server to minimalise the threats and problems caused. If one of these bots or users are found somewhere and you know which ones it are, directly ban them from your server or even blacklist them so they have no chance of entering. 

Sub-info

No pictures are provided since there might be some harmful content in then or that can be used for bad activities. We have deatiled links, thurough investigation screenshots withing the server and searching online, user and bot ID, and access the services these bots can give.

If you wish to see this info, please comment, provide your Discord username, state in what server you and what position you have there. Positions under Chiefs will not be accepted into this detailed info.

- 1st Person providing bot info: Admin of UA | Advertising

- 2nd person providing server/owner info: Owner of FREE NETWORK

- People who worked along: Trial HR of FREE ADVERTISEMENT, HR of FREE ADVERTISEMENT, CAO of Global Advertisement, 

- After information: A-CO of Turbo Promotions, CO of Turbo Promotions

- Reported to server: Global Advertisement, FREE ADVERTISEMENT, Hit Era, Nexus Network, UA | Advertising, Open Advertisements & Nitro Giveaways, Linked Advertising, Advertising Hub, Fire Advertising, SPONIC |  Advertising, Frog's Hideout, Eeppyy,